Static task
static1
Behavioral task
behavioral1
Sample
2e98d3093f9238b0e5850fe9faebe1b4_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2e98d3093f9238b0e5850fe9faebe1b4_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2e98d3093f9238b0e5850fe9faebe1b4_JaffaCakes118
-
Size
436KB
-
MD5
2e98d3093f9238b0e5850fe9faebe1b4
-
SHA1
ec9cbba0fbcd3d70e3689a147b39dab6985d129b
-
SHA256
cf7457f769a389332b7496abb20b8b94f24dd35482943e35770b4326e867c329
-
SHA512
1472e7e9f87255872b9dcc0f6f2c128e685ac779acc4cbf94c6dfbf7a3fbe71c142cb3c2de8e122e1862b5424ce926f2429226dbaa63f0aa85054a0a0c6df170
-
SSDEEP
6144:pDpWA3zbtLlyWyi2NkgPQRBfmV3PDKqpukSwNtBvAf4n+UNUh0Mu7r9Acq2yESQW:b3zZMWyi5G4035DBof16Gcq2Y5yJ+d
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2e98d3093f9238b0e5850fe9faebe1b4_JaffaCakes118
Files
-
2e98d3093f9238b0e5850fe9faebe1b4_JaffaCakes118.exe windows:4 windows x86 arch:x86
5a92279ce0cc587c58102d6c48c940c9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
CreateServiceA
CryptDestroyKey
CryptDeriveKey
RegOpenKeyA
StartServiceA
CryptSetProviderA
CryptSetProvParam
RegDeleteValueA
DuplicateTokenEx
RegQueryInfoKeyA
LogonUserA
RegEnumValueW
CryptDestroyHash
RegConnectRegistryA
RegLoadKeyA
CryptVerifySignatureW
StartServiceW
CryptGenRandom
comdlg32
GetOpenFileNameA
ChooseFontW
GetFileTitleA
ReplaceTextW
wininet
FindFirstUrlCacheEntryExW
SetUrlCacheConfigInfoW
SetUrlCacheEntryInfoW
InternetTimeFromSystemTimeA
InternetGoOnlineA
FtpCommandW
FindFirstUrlCacheEntryExA
RetrieveUrlCacheEntryStreamW
FtpDeleteFileW
ShowX509EncodedCertificate
InternetTimeFromSystemTime
HttpOpenRequestA
LoadUrlCacheContent
CommitUrlCacheEntryW
DeleteUrlCacheGroup
InternetSecurityProtocolToStringW
GetUrlCacheEntryInfoExA
DeleteUrlCacheContainerA
InternetSetDialState
IsUrlCacheEntryExpiredW
DeleteIE3Cache
InternetAlgIdToStringA
FindFirstUrlCacheContainerA
CommitUrlCacheEntryA
InternetQueryOptionA
gdi32
ExtFloodFill
GetKerningPairsA
GetNearestPaletteIndex
SetWindowExtEx
GetEnhMetaFileW
kernel32
CompareStringW
QueryPerformanceCounter
GetTimeZoneInformation
SetLastError
CommConfigDialogW
TlsAlloc
GetVersionExA
SetEnvironmentVariableA
LoadLibraryA
GetTickCount
InterlockedExchange
TlsSetValue
EnumSystemLocalesA
EnterCriticalSection
VirtualProtectEx
MultiByteToWideChar
GetFileType
GetModuleFileNameW
ExpandEnvironmentStringsW
GetCurrentProcess
TlsFree
GetCurrentProcessId
GlobalFix
GetCurrentThread
WriteFile
SetHandleCount
FreeEnvironmentStringsW
GetTimeFormatA
VirtualFree
LCMapStringW
GetDateFormatA
WideCharToMultiByte
SetConsoleCtrlHandler
VirtualAlloc
FreeEnvironmentStringsA
OutputDebugStringW
GetCurrentThreadId
GetCommandLineA
HeapFree
HeapCreate
InterlockedDecrement
HeapReAlloc
GetLastError
TerminateProcess
HeapSize
GetEnvironmentStringsW
EnumResourceNamesA
GetACP
GetDiskFreeSpaceExW
GetProcessHeap
GetStringTypeW
GetOEMCP
GetStringTypeA
InitializeCriticalSection
CreateNamedPipeW
GetModuleHandleA
WaitCommEvent
HeapDestroy
FindFirstFileExA
CompareStringA
VirtualQuery
WritePrivateProfileStructW
GetUserDefaultLCID
UnhandledExceptionFilter
ExitProcess
DeleteCriticalSection
GetLocaleInfoW
CreateEventA
LeaveCriticalSection
FreeLibrary
GetDiskFreeSpaceA
LCMapStringA
HeapAlloc
IsDebuggerPresent
GetSystemTimeAsFileTime
GetModuleFileNameA
GetLocaleInfoA
GetStartupInfoW
Sleep
GetVolumeInformationW
GetProcAddress
InterlockedIncrement
GetCommandLineW
TlsGetValue
IsValidCodePage
GetStdHandle
GetStartupInfoA
RtlUnwind
IsValidLocale
GetEnvironmentStrings
GetCPInfo
SetUnhandledExceptionFilter
Sections
.text Size: 152KB - Virtual size: 151KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 277KB - Virtual size: 299KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ